Park24 unit Times Mobility reports a massive leak of approximately 6.6 million personal data records following an unauthorized access incident. While credit card information remains secure, the company is rushing to implement recovery measures and prevent recurrence.
Park24 (Headquarters: Chiyoda-ku, Tokyo; CEO: Koichi Nishikawa) consolidated subsidiary Times Mobility Co., Ltd. detected unauthorized access to the web system of its car-sharing service "Times Car" at approximately 9:07 a.m. on September 25, 2026. An immediate investigation confirmed that a third party had accessed the system and viewed or improperly obtained a portion of the group's personal information.
To prevent further damage, the company blocked the unauthorized access path by 7:25 a.m. the following day, completely cutting off communication with the attackers. According to the disclosure, forensic investigations are underway with external experts to determine the cause and scope of the incident. Reports have been filed with the Personal Information Protection Commission and the police. The company states it will promptly inform the public via its website and individually notify affected parties if new facts or impacts emerge.
The confirmed scope of the leak involves approximately 6.6 million accounts, covering current and former Times Car members (including those whose applications were not finalized) as well as current and former Times Business Service members. The exposed personal data includes names, department names for corporate members, addresses, dates of birth, phone numbers, email addresses, driver's license information, identity verification document images, passwords, and linked service IDs.
Of particular concern are the linked service IDs for nine services, including "WESTER ID" by JR West. However, the disclosure emphasizes that passwords were stored in a non-reversible format, meaning they were not leaked in a recognizable state. Crucially, credit card information has been confirmed to be secure. There is no evidence of the data being publicly exposed or used for fraudulent activities.
| Item | Details/Scope |
|---|---|
| Affected Accounts | Approximately 6.6 million |
| Member Types | Times Car members/former members, Times Business Service members/former members |
| Leaked Data Points | Name, address, DOB, phone, email, driver's license info, ID verification images, passwords, linked service IDs |
| Credit Card Info | No leak (Confirmed secure) |
| Password Status | Stored in non-reversible format (No recognizable leak) |
These figures highlight the severity of the incident, as it resulted from intentional unauthorized access rather than a system error.
Currently, there are no reported disruptions to service provision, with all services operating normally. The early blocking of the attack likely prevented direct intrusion into core payment and real-time booking functions, but restoring customer trust in data reliability will take time.
Regarding prevention, Park24 plans to disclose both implemented countermeasures and long-term strategies along with their implementation timelines in future updates. The company is still analyzing the financial impact on its earnings and will disclose significant effects on performance promptly if identified.
While a data leak of this magnitude is concerning, the absence of credit card or plain-text password exposure limits immediate financial damages and account takeover risks. However, with 6.6 million records affected, this is among the largest in the industry. Effective prevention measures and transparent disclosure will be key to regaining investor and customer confidence. A long battle for trust restoration lies ahead.
Analyst take
The critical aspect of this incident is the massive scale of 6.6 million records leaked, contrasted with the absence of credit card data and plaintext passwords. This significantly limits direct financial losses and immediate account takeover risks. However, the exposure of names, addresses, and driver's license images raises high concerns for identity theft and phishing attacks. The company must now undergo a comprehensive review of its security management structure. Investors should closely monitor the timeline for prevention measures and any specific financial impacts, such as compensation or investigation costs, in upcoming disclosures.
